What’s Vulnerable › Vulnerabilities

CVE-2024-38395

• Severity: critical (CVSS 9.8 v3.1)
• Exploited in the wild: not listed in CISA KEV
• EPSS: 1.5% probability of exploitation in the next 30 days
• Public exploit or detection template: none known
• Published: 2024-06-16 · updated 2026-06-17
• Weakness: CWE-94

Description

In iTerm2 before 3.5.2, the "Terminal may report window title" setting is not honored, and thus remote code execution might occur but "is not trivially exploitable."

Affected products

• iTerm2: from 3.5.0 before 3.5.2 — fixed in 3.5.2

How to fix

Upgrade to a fixed version: iTerm2 3.5.2. Check the vendor advisory for mitigations.

References

• http://www.openwall.com/lists/oss-security/2024/06/17/1
• https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
• https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
• https://iterm2.com/downloads.html
• https://www.openwall.com/lists/oss-security/2024/06/15/1
• http://www.openwall.com/lists/oss-security/2024/06/17/1
• https://gitlab.com/gnachman/iterm2/-/commit/f1e89f78dd72dcac3ba66d3d6f93db3f7f649219
• https://gitlab.com/gnachman/iterm2/-/tags/v3.5.2
• https://iterm2.com/downloads.html
• https://www.openwall.com/lists/oss-security/2024/06/15/1

Get alerted when CVE-2024-38395 or the next vulnerability affects your stack